I was on site with a customer when an HR manager asked me about a specific function in Workforce Timekeeper, and how to change it. I explained that the feature they were asking about was located in the function access profile. Then I asked why they would be wanting to change their recently configured application. The customer hadn't paid for testing, and were planning to test on their own. I related to them that the function access profiles were a "vast area of Kronos configuration from which few come out unscathed" and that I would have to unpack my whip and chair. It was a bit of a joke, but the key to this was simple. The customer was looking for me to assist in a change in the configuration of their application "on the fly".